Cisco adds malware security features in Tetration analytics

Cisco has upgraded the security in its Tetration analytics system to spot software vulnerabilities, identify abnormal activity and stop unauthorized communications between applications. The latest features apply to applications running in the data center and the cloud.

Cisco said the latest security features, introduced this week, equip Tetration to battle recent security threats, such as the Spectre and Meltdown CPU vulnerabilities. Hackers have developed dozens of different types of malware to exploit the flaws, but so far, there are no reports of stolen corporate data.

Security enhancements in Tetration include using the Common Vulnerabilities and Exposures (CVE) catalog of threats sponsored by the U.S. Department of Homeland Security. Tetration uses the CVE catalog to identify potentially vulnerable applications and rank the seriousness of the threat.

Security operators can choose their response to threats by setting up policies that dictate taking specific actions, such as quarantining software. Managers set the policies for cloud and data center applications through Tetration's user interface or APIs.

Tetration also helps IT managers find malicious application processes by building an inventory of those that are running or have run. Details kept on each process include its parameters, who is using it and for how long.

Finally, Cisco has added technology to Tetration that creates an application behavior baseline, which establishes what constitutes regular activity. Tetration flags deviations to managers as possible malware attacks. Examples of abnormal behavior would include privilege escalation, shellcode execution or side-channel attacks.

"These are typical techniques that malware uses," said Yogesh Kaushik, senior director of Tetration. "What Tetration is now doing is tracking all of those things and detecting those events."